VPNs are incredibly useful tools for online privacy and security – here at TechRadar, we use the best VPNs every day for work and personal computing alike. However, not everyone is such a fan of virtual private networks: across the world, some governments and internet service providers have attempted to restrict or outright ban VPN usage.
As TechRadar has reported, China has expanded its Great Firewall to crack down on VPN use, and Russia has drafted plans for an AI system that would block 95% of VPNs. Even in liberal democracies, pushes for online safety and transparency have had some commentators worried about the future of VPNs.
Due to the very nature of VPNs – which hide a user’s IP address and encrypt data sent to and from websites and other users – those using one are much harder to track, trace, and apprehend. Countries with oppressive regimes often have a vested interest in collecting and examining citizens’ online activity, meaning VPNs end up blocked or banned.
Obfuscation can offer a workaround in situations where VPN use is monitored or restricted, or indeed if you just want to be extra cautious about online privacy and tracking. Obfuscation refers to VPN protocols that hide the fact that they use a VPN whatsoever – an obfuscated VPN is as secure and protected as any other VPN, but to outside observers it looks like a normal internet connection.
Keep reading for our breakdown of VPN obfuscation and when you should use it. Please note that Future Publishing does not endorse illegal use of VPNs, and obfuscation should only be used when it is safe to do so.
What is VPN obfuscation?
VPN services implement obfuscation in a variety of ways. Some describe it as a ‘stealth’ mode, or give it another catchier tagline, such as NordVPN’s NordWhisper protocol or Surfshark’s Camouflage Mode.
We’ll go over the various methods of obfuscation in the next section, but generally the goal is to make VPN-encrypted traffic look the same as regular HTTPS traffic, which makes up most of the internet.
Data moves through the internet in packets, each of which has some metadata about the protocol used to transmit it. Obfuscation commonly works by encrypting data with a VPN then bundling the result in a standard HTTPS protocol, or by scrambling metadata to make it invisible to detection algorithms.
That said, obfuscation doesn’t make a VPN entirely undetectable. At the request of the relevant authorities, or even private companies, ISPs can use Deep Packet Inspection to examine your traffic and determine whether you’re using a VPN. The ISP may choose to limit or block your internet access if VPN use goes against local restrictions or its own policies.
If you’ve ever tried to visit a commonly-banned website like YouTube or Wikipedia while travelling, you’ve probably been blocked by DPI.
Types of VPN obfuscation
As mentioned, most VPN obfuscation methods fall into one of two camps – those that re-encrypt data to make it look like HTTPS, and those that scramble data to make it invisible to algorithmic detection.
Here’s a rundown of the most commonly used obfuscation techniques:
- TCP/IP Wrapping: TCP/IP wrapping takes the VPN-ified data you transmit and ‘wraps’ it in a standard data transfer protocol, which makes it look like typical web traffic while on the move.
Examples of TCP/IP wrapping include Secure Socket Tunnel Protocol, which wraps your data in standard HTTPS encryption, and Stunnel which adds additional security with a proxy server. - Shadowsocks (a.k.a SOCK5 Proxy): Shadowsocks is an opensource proxy server that works similarly to Stunnel. It was designed by a Chinese programmer in an effort to get around the country’s infamous Great Firewall.
- Obfsproxy: A proxy server designed to get around VPN restrictions on the Tor browser, Obfsproxy differs from other methods as it leaves no recognisable patterns as two computers try to verify the others’ identity.
- OpenVPN Scramble: Unlike wrapping methods, OpenVPN Scramble simply jumbles up OpenVPN’s residual metadata with a set cipher. It’s hard to decode, but can be cracked with the appropriate effort.
Why should you use VPN obfuscation?
1. Bypass VPN bans
VPN obfuscation is best known for its use in getting around VPN bans and restrictions. Because obfuscation makes your VPN-wrapped data look like normal web traffic, the algorithms that identify VPNs are far less likely to pick up on your usage.
Some public institutions, like libraries, hotels, schools, and universities, put limits on the websites guests can access. An obfuscated VPN can help to unblock these sites for study or work purposes.
In regions with repressive internet restrictions, using a VPN is often a criminal offence – so using a VPN service, even with obfuscation enabled, is at your own risk. TechRadar does not endorse using VPNs to break the law.
2. Improve your online privacy
Many internet users use a VPN to improve their online privacy by reducing their digital footprint and making their online traffic harder to trace. Obfuscation makes it even harder for bad actors to trace your internet usage by hiding the fact you’re using a VPN at all. That can make it extremely difficult to trace your activity or identity.
3. Unblock streaming content
Streaming sites like Netflix and Amazon Prime Video are increasingly using VPN blockers to crack down on users accessing content from other countries. The licenses these streamers pay for content are generally region-specific, so it’s in their interest to limit access based on geographic location.
However, if you’re a Brit travelling through Europe and want to reliably access British streaming services, an obfuscated VPN can let you catch up with your favorite shows by tricking blockers into seeing your connection as normal web traffic.
Which stealth VPN should you choose?
Many of the best VPNs, and even some of the best cheap VPNs, offer obfuscation as a feature in basic or higher-tier plans. Even so, choosing the best stealth VPN depends on what you’re looking for, how much you’re willing to spend, and your online privacy and security needs.
We recommend picking an established, well-reviewed VPN provider if you’ll be relying on it to get around national VPN restrictions. Having your VPN detected in restricted regions can put you at risk of criminal penalties, so it’s important that the obfuscation doesn’t fail mid-connection.
Many of our favorite stealth VPNs are listed on our list of the best VPNs:
- NordVPN offers the NordWhisper protocol, which uses TCP/IP wrapping
- Surfshark has Camouflage Mode, which changes packet data to evade DPI
- Proton VPN offers Stealth mode, which wraps data in a standard TLS tunnel
- ExpressVPN has no toggleable obfuscation, but activates it automatically when blockers are detected
- PrivadoVPN has Scramble mode, which disguises VPN traffic as typical HTTPS traffic
For obfuscation purposes, we particularly recommend NordVPN, Surfshark, and ExpressVPN, which are amongst the most reliable VPN services we've tested.
These VPNs, and others on the market, offer other benefits and drawbacks in addition to their obfuscation abilities – NordVPN, for example, has the largest server network of any VPN, while Surfshark offers low prices for its full feature set.
